Current engines of the turbojet type are often associated with regulating computers that are generally installed near and sometimes even in an area, called the “fire area” of the engine. In the “fire area,” continuously monitoring the temperature is essential to prevent a potential fire.
One of the main dangers in the case of fire is the loss of control of the engine that may introduce an engine overspeed.
A second computer may be provided so as to prevent an engine overspeed. This may be the case when it is possible to separate the control of the engine regulation functions and the overspeed control and detection functions. Typically, in this case a breakdown of one computer does not automatically lead to the breakdown of the second.
Depending on the architectures, the overspeed regulation and protection functions may be carried out by the same computer or by independent computers.
In architectures where the computer ensures the two functions, some precautions must be taken so as to minimize cases of possible equipment breakdowns and ensure a sufficient level of operational safety. The operational safety level may be ensured by a redundant architecture of values from the measurement sensors so as to enable exhaustive detection of cases of breakdowns while minimizing the rates of false detection regardless of the configuration of the controlled equipment.
In one fire area near a turbojet, a fire may:                introduce an overspeed, since the computer regulation part may for example:                    generate an erroneous fuel regulation command or;            engage an erroneous valve closure due to an error in the control operating conditions or;            acquire erroneous data from the sensors,                        Lose overspeed protection due to loss of the computer overspeed function.        
In case of fire, a risk of generating erroneous engine regulation behavior possibly triggering a malfunction leading to loss of overspeed protection may occur. The engine protection and regulation control functions are therefore sensitive to the same malfunctions. The cause of the overspeed protection system malfunction is then the same as that of the engine regulation.
The event called “uncontrolled overspeed” is classified as a so-called “Hazardous” event by the certification authorities. Preventing the scenario mentioned previously is therefore essential. In particular, the common mode produced by the computer hosting the engine regulation and overspeed protection functions must be supported and/or made redundant so as to enable rapid detection of the measurements with a minimized false detection rate. The performance level must be identical in the nominal case and in the case of an accident for example, i.e., in which the environmental conditions are extraordinary.
The previous reasoning also applies to the overthrust protection and overthrust regulation system.
Some current solutions enable this problem to be resolved. One solution consists of putting a fire protection system in place that cuts the engine to prevent uncontrolled overspeeds during a detection.
One possible architecture for the regulating computer fire protection system uses two internal temperature sensors and two thermistor type external fire detectors.
In one implementation, each of these external detectors may be regarded as variable resistance. In technical literature, this variable resistance is also known as “VRT,” standing for “Variable Resistance Transducer.”
The thermistor may be configured such that detection of global overheating or a localized flame may occur due to the variation in its resistance. The regulating computer regularly acquires a resistance value from a thermistor and performs calculations enabling the change in temperature to be controlled.
In particular, the regulating computer converts the value of the measured resistance to temperature from a table, for example. Lastly, a comparison may be made from a predefined threshold. When the value exceeds a threshold, overheating or a flame may be declared by the detection system.
Other conditions may be tested by calculations of environmental parameters, particularly by comparing the values with predefined thresholds. The regulating computer may be programmed so as to cut the engine to prevent an overspeed in case of the detection of an environmental parameter, such as temperature, going beyond a defined threshold.
Nevertheless, existing solutions present disadvantages regarding operational safety.
So as to enable, on the one hand, optimal detection of values from the environmental condition measurement sensors and, on the other hand, effective discrimination between the case of a sensor malfunction and the case of detection of a real fire for example, control devices often comprise two identical chains functionally enabling data collection to be replicated before an action is undertaken. These chains are also called channels. Each channel comprises a measurement acquisition module, a control module and a power supply. The channels should ideally be independent from each other, nevertheless they may exchange information so as to perform correlation operations of data measured on both sides.
A first channel A and a second channel B perform similar calculations so as to correlate their results and ensure that detection of a value from a sensor indicating a danger is really such a detection and not a detection error.
One of the major problems is that when a channel fails, then data replication must always be ensured, all the more so as a channel failure has just occurred.
For example, it is understood that an aircraft in flight and undergoing degradation of one of its engine control channels must be able to finish its flight and return while ensuring maximum safety.
In certain cases, the aircraft must go on a certain number of missions before any maintenance operation.
In the present case, if a channel fails, only one sensor and one fire detector remains to ensure detection of a fire or overheating.
In case of loss of a channel, malfunction of the remaining fire detector is not an operational constraint to the extent that this malfunction detection is combined with detection of a fire, for example from an internal temperature sensor. The fire is also considered to be a malfunction, therefore to not detect a fire breaking out with a single channel, a double malfunction must be produced. In the latter case, the false malfunction rate is acceptable.
However, an inadvertent detection may occur on a simple malfunction of the remaining fire detector, and the inadvertent detection rate of a detector not being low enough, one risk is to detect a fire when no fire exists and to therefore cut the engine.
This latter solution does not constitute an acceptable operation for an aircraft.
Some solutions consist of multiplying the number of sensors and increasing architecture density by making them all the more complex and costly. For example, it is possible to use up to four temperature sensors, or two per channel.
With this solution, each channel acquires two thermistor measurements. Therefore, when one channel malfunctions and only one functional channel remains, two thermistors remain that issue their measurements.
An inadvertent fire or overheating detection may therefore only be because of a double malfunction, which is acceptable.
However, by doubling the number of thermistors, the mass of the device is doubled. In addition, the cost is increased all the more as it is necessary to add a second sensor onto each of the channels. Lastly, the available volume around the computer does not guarantee installation of these four detectors.
Another solution consists of using non-electrically powered sensors, as a consequence they may be independent from the power supply of the channel to which they are associated. For example, “pneumatic” type fire detectors may be used.
Pneumatic detector technology enables discrete entities to be acquired by the computer. When a device acquires a discrete entity, it acquires a current but the fact that it is divided by two due to redundancy and the fact that the redundancy degrades accuracy does not cause interference, since only “powered”/“unpowered” states are necessary. Obtaining the exact value of the current is not necessary. In addition, as mentioned previously, the computer should not power the detectors with this pneumatic technology.
However, a pneumatic detector is approximately twice as expensive as a thermistor, and approximately twice as heavy, and as this would involve modifying the electrical interface on each channel, this solution presents a disadvantage in solutions in which it is necessary to reduce costs.